Ensure Farm Administrators group membership is restricted

HochStufe 1Manuelle Prüfungsharepoint

Beschreibung

Farm Administrators have full control over every server and site collection; membership must be limited to named administrators.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Central Administration > Security > Manage the farm administrators group: confirm only approved named admin accounts [and BUILTIN\Administrators if required] are members; no users, broad groups or service accounts other than the farm account. Also check Get-SPShellAdmin output and the local Administrators group on each farm server.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Remove unapproved members from the Farm Administrators group in Central Administration and with Remove-SPShellAdmin; document approved membership.

Eigenschaften

Betriebssysteme: Beliebig
Tags: sharepointaccounts
Referenz: CIS Microsoft SharePoint Server Benchmark - Service accounts / Farm Administrators group (verify section number for your release)